Star Blizzard

Star Blizzard is a Russia-based cyber espionage group assessed by the UK National Cyber Security Centre (NCSC) and international partners as almost certainly subordinate to the Russian Federal Security Service (FSB) Centre 18. Active since at least 2019, the group has conducted persistent spearphishing campaigns targeting academia, defense, governmental organizations, NGOs, think tanks, and politicians, with targets in the UK and US most affected. The group is characterized by its sophisticated social engineering techniques, including extensive pre-attack reconnaissance using open-source resources and social media to identify hooks to engage targets. Star Blizzard creates impersonation accounts mimicking known contacts of their targets, often building rapport over extended periods before delivering malicious links. The group uses the open-source EvilGinx framework to harvest credentials and session cookies, successfully bypassing two-factor authentication.